Attackers Target 60,000 GitHub Repositories in Credential Theft Campaign

Security researchers have attributed a credential theft campaign, nicknamed wfx-loot, to an attacker who tested stolen access across more than 60,000 GitHub repositories. Aikido Security says the operation began on 10 November 2026 and identified roughly 4,800 compromised accounts behind probe pull requests submitted to 61,764 repositories.

StepSecurity notes that the requests were used to gauge whether stolen tokens permitted changes to a repository; the pull requests themselves did not perform any action, but malware was deployed in repositories where permissions and configuration allowed it. In practice, researchers observed the stealer running in more than 1,800 repositories, while SafeDep reports 8,093 public repositories received malicious commits—though that count does not prove successful execution in all cases.

The attacker did not exploit a GitHub Actions bug, according to StepSecurity. Instead, they used valid tokens belonging to developer and bot accounts to inject malware into existing or new GitHub Actions workflows, shell scripts run by CI systems, and npm installation hooks. The malicious code searches for GitHub tokens, repository secrets, cloud credentials and AI service keys, and can read GitHub Actions runner memory to expand access and maintain persistence in AWS and Azure.

In many instances, actors reversed code changes and deleted workflow runs to conceal activity. Aikido identifies similarities with the GhostAction campaign from October but cautions that the two operations likely involve different actors. The security firms urge organisations to revoke compromised tokens, rotate exposed secrets and examine for unauthorised cloud changes.